diff --git a/src/main.js b/src/main.js
index 38892fb..8352947 100644
--- a/src/main.js
+++ b/src/main.js
@@ -60,6 +60,9 @@ async function main() {
     const outputFormats = process.env.INPUT_OUTPUT_FORMATS;
     const exitCode = process.env.KICS_EXIT_CODE
 
+    // the scan verdict comes first so a reporting failure can never hide it
+    setWorkflowStatus(exitCode);
+
     try {
         const octokit = github.getOctokit(githubToken);
         let context = {};
@@ -80,7 +83,13 @@ async function main() {
         enableComments = enableComments ? enableComments : "false"
         enableJobsSummary = enableJobsSummary ? enableJobsSummary : "false"
 
-        const parsedResults = readJSON(outputPath.resultsJSONFile);
+        let parsedResults;
+        try {
+            parsedResults = readJSON(outputPath.resultsJSONFile);
+        } catch (e) {
+            core.setFailed(`Could not read the KICS results: ${e.message}`);
+            return;
+        }
         if (enableAnnotations.toLocaleLowerCase() === "true") {
             annotator.annotateChangesWithResults(parsedResults);
         }
@@ -91,7 +100,6 @@ async function main() {
             await commenter.postJobSummary(parsedResults, commentsWithQueries.toLocaleLowerCase() === "true", excludedColumnsForCommentsWithQueries);
         }
 
-        setWorkflowStatus(exitCode);
         await cleanupOutput(outputPath.resultsJSONFile, outputFormats);
     } catch (e) {
         console.error(e);
diff --git a/test/e2e/action.test.js b/test/e2e/action.test.js
index fa36f2a..dfb76fb 100644
--- a/test/e2e/action.test.js
+++ b/test/e2e/action.test.js
@@ -5,13 +5,9 @@ const assert = require('node:assert/strict')
 const { runAction } = require('../helpers/run-action')
 const { startFakeGitHub, humanComment } = require('../helpers/fake-github')
 const { kicsResults, query, finding } = require('../helpers/fixtures')
-const { knownBug } = require('../helpers/known-bug')
 
 const KICS_FOUND_RESULTS = '50'
 
-const SILENT_FAILURE =
-    'main() swallows every exception, so a KICS failure is never reported when GitHub or results.json cannot be used'
-
 test('pull request comment', async (t) => {
     await t.test('is not posted unless enable_comments is on (the default)', async (t) => {
         const fake = await startFakeGitHub(t)
@@ -171,19 +167,19 @@ test('workflow status follows the KICS exit code', async (t) => {
         assert.equal(run.code, 0)
     })
 
-    await t.test('fails when KICS fails and the PR comment cannot be posted', knownBug(SILENT_FAILURE), async (t) => {
+    await t.test('fails when KICS fails and the PR comment cannot be posted', async (t) => {
         const fake = await startFakeGitHub(t, { failWith: 500 })
         const run = await runAction(t, { results: kicsResults(), kicsExitCode: KICS_FOUND_RESULTS, inputs: { enable_comments: 'true' }, apiUrl: fake.url })
         assert.equal(run.code, 1, 'a GitHub API outage must not turn a failed scan into a green build')
     })
 
-    await t.test('fails when KICS failed and wrote no results.json', knownBug(SILENT_FAILURE), async (t) => {
+    await t.test('fails when KICS failed and wrote no results.json', async (t) => {
         const run = await runAction(t, { kicsExitCode: '126' })
         assert.equal(run.code, 1, run.stdout + run.stderr)
         assert.ok(run.errors.length > 0)
     })
 
-    await t.test('reports a missing results.json instead of passing silently', knownBug(SILENT_FAILURE), async (t) => {
+    await t.test('reports a missing results.json instead of passing silently', async (t) => {
         const run = await runAction(t, { kicsExitCode: '0', inputs: { enable_comments: 'true' } })
         assert.notEqual(run.code, 0, 'the scan produced no report, which is not a success')
     })